topic Re: CentralOps Whois Technology Add-On: How to change default output? in All Apps and Add-ons

CentralOps Whois Technology Add-On: How to change default output?

jairjr — Thu, 20 Apr 2017 22:51:39 GMT

When trying an ip without a domain, like for example: 173.xxx.xxx.129, I get: resolved_domain 173.xxx.xxx.129.

How can I set it to bring me another field instead when no domain is found?

Re: CentralOps Whois Technology Add-On: How to change default output?

doksu — Thu, 20 Apr 2017 23:50:22 GMT

The app doesn't currently support IP lookups, however I've raised a feature request on your behalf (https://github.com/doksu/TA-centralops/issues/4), which I'll endeavour to have implemented next week. Once complete I'll post an update here.

Re: CentralOps Whois Technology Add-On: How to change default output?

jairjr — Fri, 21 Apr 2017 00:14:26 GMT

Got it, thank you for the quick response.

Re: CentralOps Whois Technology Add-On: How to change default output?

doksu — Fri, 28 Apr 2017 02:09:20 GMT

As promised, I've implemented this new feature.

Re: CentralOps Whois Technology Add-On: How to change default output?

doksu — Fri, 28 Apr 2017 02:12:15 GMT

Thanks for the question jairjr. As per my previous answer, I've now added a new feature to support ip whois queries. Please see https://splunkbase.splunk.com/app/3506/

Also, if you need autonomous system (ASN) information, be sure to check out my asngen app: https://splunkbase.splunk.com/app/3531/

Re: CentralOps Whois Technology Add-On: How to change default output?

jairjr — Sat, 29 Apr 2017 00:10:25 GMT

Thank you! Do you have idea why some IPs just bring me the field resolved_domain?

Re: CentralOps Whois Technology Add-On: How to change default output?

doksu — Tue, 02 May 2017 02:29:55 GMT

Do you get a response if you use the 'whois' command to query that IP from your local machine? The information presented in the app comes from https://centralops.net/co/domaindossier.aspx, so if that site doesn't return any results for an IP, you'll just get a 'resolved_domain' field in the app.

Re: CentralOps Whois Technology Add-On: How to change default output?

doksu — Tue, 02 May 2017 02:30:21 GMT

Hi jairjr, could you please accept this answer?